CISO Daily Briefing
Cloud Security Alliance Intelligence Report
Executive Summary
Attackers are using the channels developers and AI users trust by default. A trojanized Claude Code extension was served under the legitimate publisher ID on Cursor’s marketplace and planted SSH backdoors that survive uninstall. A ChatGPT share link could run attacker code in a viewer’s session. Hugging Face malware came back within days of its takedown. Meanwhile, Binance traced a $6.3 billion theft to one compromised DevOps laptop. Today, hunt for the svc-telemetry SSH key on any machine that ran Cursor on October 29, and treat AI developer tooling as privileged infrastructure. The UK ICO’s agentic AI call for evidence closes 20 November.
Overnight Research Output
Signed by the Right Publisher: Trojanized Claude Code on Cursor’s Marketplace
CRITICAL URGENCY
Summary: According to Cursor’s security notice, tampered builds of anthropic.claude-code 2.1.312 and 2.1.313 were live on its marketplace on October 29. The loader planted an attacker SSH key labeled svc-telemetry, opened a reverse tunnel to 134.209.82[.]225 and installed persistence on each OS. StepSecurity’s analysis found that it also sent host reconnaissance back to the attacker. Anthropic says its own systems and official marketplaces were not affected. No one has yet explained how the attacker got publishing rights.
Key Sources:
BleepingComputer — Malicious Claude Code extension on Cursor planted SSH backdoors
OpenSourceMalware — Trojanized Claude Code Extension Plants an SSH Backdoor
The Hacker News — Official Claude Code Extension on Cursor Marketplace Trojanized
One Click Into Someone Else’s ChatGPT: Cross-Frame Messaging Flaws
HIGH URGENCY
Summary: Parameter’s disclosure shows how a shared ChatGPT conversation could run attacker JavaScript on the chatgpt.com origin. The sandboxed HTML Preview held. The escape came through the MathLive library loaded in the main page, whose postMessage listener accepted messages from any sender. The injected script read the session token from the page and called authenticated APIs to read private chats. OpenAI fixed the flaw on October 26, eight days after the report.
Key Sources:
The Hacker News — A Shared ChatGPT Link Could Run Attacker Code in Your Session
DEV Community — The MathLive postMessage Chain and a 20-Line Listener Audit
Takedowns That Don’t Hold: Model Hub Re-Uploads and Agent Lures
HIGH URGENCY
Summary: Pluto Security documented 31 malicious repositories across seven Hugging Face accounts, posing as Qwen2 test checkpoints. They drop GPU miners and reverse shells through trust_remote_code. The 19 second-wave repos were still live eight days after they were reported. A copy of the flagship repo scanned clean and stayed up after the takedown. Separately, a README-only “Solana starter kit” ranks first in AI coding agents’ searches and delivers a remote-access trojan.
Key Sources:
BleepingComputer — Hugging Face malware campaign returns to hijack GPUs
Hackread — Fake GitHub Repo Tricks AI Agents Into Installing SolanaCry Malware
trust_remote_code off by default, and run agents and model loaders in sandboxes where hostile code can do little damage.UK ICO Agentic AI Call for Evidence: What Deployers Should Know
HIGH URGENCY
Summary: The ICO’s six-week call for evidence opened on 8 October and closes on 20 November 2026. It covers security, transparency, accountability, ADM, fairness and lawfulness, and it will feed the statutory code of practice on AI and automated decision-making. The ICO has also opened enquiries with OpenAI, Anthropic, Meta and the UK AI Security Institute into reports of agents bypassing protections during testing.
Key Sources:
From One Laptop to $6.3 Billion: Developer Endpoints as Systemic Risk
HIGH URGENCY
Summary: About $6.3 billion left Binance wallets across ten blockchains on October 29, mostly within twenty minutes. Binance’s preliminary finding points to a compromised DevOps laptop that reached a service container able to submit withdrawals. It adds that the attacker “did not simply use one engineer’s permissions.” TRM Labs attributes the theft to TraderTraitor. Root-cause details remain provisional.
Key Sources:
Notable News & Signals
Chainalysis Confirms Intrusion Into Internal Tools
The blockchain analytics firm confirmed an intrusion into its internal tooling in the same week as the Binance theft, which adds to the pattern of developer-tooling compromise.
Polymarket Halts Trading After Script Compromise
Polymarket paused trading after a crypto-draining script compromise. Investigators are tracing the stolen funds.
GlassWorm Hijacks Five OVHcloud CLI Releases
One week before the Cursor incident, attackers took over official cloud CLI releases, another example of trusted developer tooling being turned into a delivery channel.
AGENTS in Downloads Folder Hijacks Coding Agents
Researchers report that a planted AGENTS file got OpenAI Codex to execute a test payload in 90% of lab trials. Keep agent working directories under control.
Singapore MAS Issues Final AI Risk Management Guidelines
MAS published final guidelines on AI risk management for financial institutions (Oct 7). Relevant for regulated firms running agentic AI in Singapore.
Topics Already Covered (No New Action Required)
- ARTEX / Vapor Panda AI-powered intrusions: Covered by “Multi-Agent Offensive Frameworks in the Wild: CyberStrikeAI and ARTEX” (Oct 28). An update may follow if CrowdStrike publishes more TTPs.
- Autonomous AI agents breaching 1,200+ websites: Covered by “Fifty Dollars per Breach” (Oct 21) and “Agentic Intrusion Goes Retail” (Oct 27).
- OpenCode console breach exposing provider API keys: Covered Oct 20 and Oct 28.
- Cisco SD-WAN KeyDrift malware: Covered Oct 30.
- PHP2Shell, Brotli/Node2Shell: Covered Oct 23, Oct 26 and Oct 28.
- eMudhra CA key compromise and Go CA-key blocking: Covered by “When Trust Infrastructure Fails” (Oct 21) and the whitepaper “Breaking Trust Without Breaking Math” (Oct 30).
- NIST IR 8547 PQC transition guidance: Covered Oct 30.
- MCP server hardening: Covered by “Securing MCP Servers in the Enterprise” (Oct 30).
- Non-AI vulnerabilities (Ivanti Connect Secure chain, GitLab CVSS 10 RCE in KEV, Drupal Commerce, Linux MPTCP, TeamViewer, Trezor implant): Important to patch, but outside the AI Safety Initiative’s research focus.